{"id":"CVE-2026-76306","kind":"vulnerability","aliases":["CVE-2026-76306"],"related":[],"title":"Splunk SOAR: Observer role can infer other users' password hashes and tokens","description":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.\nThe information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","summary":"Splunk SOAR before 8.7.0 applies REST API query filters to user records before masking sensitive fields. A user with the Observer role can use those filters to infer other users' password hashes and authorization tokens.","severity":"high","cvss":7.5,"epss":0.00222,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rest-api","self-hosted","splunk-soar"],"not_affected_if":["no-observer-users","version-8.7.0-or-later"],"how_to_check":"- Check the installed Splunk SOAR version in the product's about or system information page; versions below `8.7.0` are affected.\n- Review which accounts hold the Observer role in Splunk SOAR user management.","fix":"- Upgrade Splunk SOAR on-premises to `8.7.0` or later.\n- Rotate passwords and API tokens for users if Observer-role accounts may have queried user records before the upgrade (unknown whether the sources require this).","status":"open","published_at":"2026-10-21T23:17:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:18+00:00","updated_at":"2026-10-25T03:16:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:16:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk SOAR on-premises to `8.7.0` or later.\n- Rotate passwords and API tokens for users if Observer-role accounts may have queried user records before the upgrade (unknown whether the sources require this).","reach":"network","title":"Splunk SOAR: Observer role can infer other users' password hashes and tokens","impact":"high","summary":"Splunk SOAR before 8.7.0 applies REST API query filters to user records before masking sensitive fields. A user with the Observer role can use those filters to infer other users' password hashes and authorization tokens.","category":"package","nicknames":[],"who_cares":["splunk-soar","self-hosted","rest-api"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads other users' password hashes and tokens, enabling account takeover.","analyst_note":"Check the Splunk advisory for the exact fixed build and whether token rotation is advised; sources cite only the NVD entry and help docs.","how_to_check":"- Check the installed Splunk SOAR version in the product's about or system information page; versions below `8.7.0` are affected.\n- Review which accounts hold the Observer role in Splunk SOAR user management.","needs_analyst":true,"not_affected_if":["version-8.7.0-or-later","no-observer-users"],"who_is_affected":"Teams running on-premises Splunk SOAR below 8.7.0 that have users assigned the Observer role. Any Observer account can make the REST API query, so the exposure depends on who holds that role. Installations on a fixed version or with no Observer-role users are not affected by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3682,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76306':15A,18A '/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':159C '/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data),':145C '/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':139C '8.7.0':32B,69C 'api':22B,35B,87C,108C,129C 'appli':33B,106C 'author':62B,93C 'could':77C 'cve':13A,16A 'data':142C 'disclosur':100C 'document':163C 'field':44B,118C 'filter':37B,54B,80C,110C 'hash':10A,60B,91C 'help.splunk.com':138C,144C,158C 'help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':157C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data),':143C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':137C 'host':25B 'infer':6A,56B,89C 'inform':99C,124C 'manag':147C 'mask':42B 'observ':3A,49B,75C 'on-premis':134C,154C 'packag':19B 'password':9A,59B,90C 'permiss':150C 'possibl':102C 'premis':136C,156C 'process':121C 'protect':116C 'queri':36B,79C,109C,120C,140C 'record':40B,113C 'refer':130C 'represent':83C 'rest':21B,34B,86C,107C,128C 'rest-api':20B 'role':4A,50B,76C,148C 'see':125C 'self':24B 'self-host':23B 'sensit':43B,117C 'soar':2A,28B,30B,66C,105C,133C,153C 'splunk':1A,27B,29B,65C,104C,132C,152C,162C 'splunk-soar':26B 'state':84C 'token':12A,63B,94C 'transfer':85C 'use':52B,78C,126C 'user':8A,39B,46B,58B,71C,97C,112C 'version':67C","nicknames":[],"mitigations":[],"who_affected":"Teams running on-premises Splunk SOAR below 8.7.0 that have users assigned the Observer role. Any Observer account can make the REST API query, so the exposure depends on who holds that role. Installations on a fixed version or with no Observer-role users are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76306","severity":null,"published_at":"2026-10-21T23:17:28+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76306","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76306","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}